CVE-2026-126359: Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Summary
The css helper in hono/css escapes a / that follows < inside an interpolated value so that a value cannot close the <style> element. The check only looks inside each value. When the text before a value ends with <, whether that is the template itself or an earlier interpolated value, and the next value starts with /, the / is not escaped and the combined output contains an unescaped closing tag.
Details
Interpolated string values are escaped one at a time before they are joined with the surrounding template text. The rule that neutralizes </ therefore cannot see a < that belongs to the template. A template such as a content declaration that opens with a literal < and interpolates a string right after it produces a raw </style> when that string starts with /style>. During server-side rendering the <Style /> element is closed early and the rest of the value is interpreted as HTML.
This issue arises only when < is the last character before an interpolation in a css template, either written in the template or supplied by a preceding value, and the interpolated value is controlled by a client.
Impact
A client that controls such a value can inject HTML, including script, into the page rendered on the server.
This may lead to:
- Execution of attacker-controlled script in the browser of a user who views the page - Exposure of information available to that page
This issue affects applications that interpolate untrusted strings into a css template immediately after a <, including two adjacent interpolations such as ${prefix}${name} where both are untrusted. Other uses of the css helper are not affected.
Workarounds
Do not interpolate untrusted values into css templates, or make sure the text before an interpolated value does not end with <.
Other sources
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/honoto a version that resolves this vulnerability.Fixed in 4.13.16 - Upgrade
Upgrade
Honoto a version that resolves this vulnerability.Fixed in 4.13.16 - Compensating control
Do not interpolate untrusted values into css templates, or ensure the text immediately before an interpolated value does not end with <.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed only if they use the hono/css css helper and place client-controlled data into an interpolation immediately after a literal < character. The preceding < can come from the template text or from an earlier interpolated value.
What must an attacker control to exploit it?
An attacker must be able to supply the value used by the affected interpolation and cause it to begin with /, such as /style>. Exploitation also requires the application to render the resulting <Style /> element during server-side rendering.
Are ordinary css helper interpolations affected?
No. The issue occurs specifically when < is the final character before an interpolation and the following client-controlled value starts with /. The helper's per-value escaping does not detect the </ sequence once the template and interpolation are joined.
How can I identify potentially vulnerable code?
Review css templates for interpolations directly following a trailing <, including cases where that < is produced by a previous interpolation. Prioritize locations where the next interpolated value can be influenced by a client and is rendered through <Style /> during server-side rendering.